@stigmer/runner 3.40.1 → 3.41.0

package/src/__tests__/exit-backstop.test.ts

@@ -0,0 +1,91 @@
+import { afterEach, describe, expect, it, vi } from "vitest";
+import { EXIT_BACKSTOP_MS, armExitBackstop, describeResources } from "../exit-backstop.js";
+
+/**
+ * The exit backstop's contract (exit-backstop.ts): it never holds the loop,
+ * it stays silent before its bound, and at the bound it names what is still
+ * alive and exits 0, once. The real-process behaviour (a healthy runner
+ * exits in milliseconds, a leaked handle is cut at the bound) is proven
+ * against the built runner and by the execution conformance harness's
+ * slow-exit line; these pin the logic.
+ */
+
+afterEach(() => {
+  vi.useRealTimers();
+});
+
+function arm(overrides: { boundMs?: number; resources?: string[] } = {}) {
+  const exit = vi.fn<(code: number) => void>();
+  const log = vi.fn<(line: string) => void>();
+  const timer = armExitBackstop({
+    boundMs: overrides.boundMs,
+    exit,
+    log,
+    activeResources: () => overrides.resources ?? ["TCPSocketWrap", "Timeout", "TCPSocketWrap"],
+  });
+  return { exit, log, timer };
+}
+
+describe("armExitBackstop", () => {
+  it("does not hold the event loop", () => {
+    const { timer } = arm();
+    try {
+      expect(timer.hasRef()).toBe(false);
+    } finally {
+      clearTimeout(timer);
+    }
+  });
+
+  it("stays silent before the bound", () => {
+    vi.useFakeTimers();
+    const { exit, log } = arm();
+
+    vi.advanceTimersByTime(EXIT_BACKSTOP_MS - 1);
+
+    expect(exit).not.toHaveBeenCalled();
+    expect(log).not.toHaveBeenCalled();
+  });
+
+  it("at the bound, names what is still alive and exits 0, once", () => {
+    vi.useFakeTimers();
+    const { exit, log } = arm();
+
+    vi.advanceTimersByTime(EXIT_BACKSTOP_MS);
+    vi.advanceTimersByTime(EXIT_BACKSTOP_MS);
+
+    expect(log).toHaveBeenCalledTimes(1);
+    expect(log.mock.calls[0]?.[0]).toBe(
+      `[runner] Process still alive ${EXIT_BACKSTOP_MS}ms after shutdown; forcing exit. ` +
+        "Active resources: TCPSocketWrap×2, Timeout×1",
+    );
+    expect(exit).toHaveBeenCalledTimes(1);
+    expect(exit).toHaveBeenCalledWith(0);
+  });
+
+  it("honours an explicit bound", () => {
+    vi.useFakeTimers();
+    const { exit } = arm({ boundMs: 250 });
+
+    vi.advanceTimersByTime(249);
+    expect(exit).not.toHaveBeenCalled();
+    vi.advanceTimersByTime(1);
+    expect(exit).toHaveBeenCalledWith(0);
+  });
+
+  it("keeps the bound above the conformance harness's 2 s slow-exit line", () => {
+    // Below it, the harness would stop reporting the very leaks this cuts.
+    expect(EXIT_BACKSTOP_MS).toBeGreaterThan(2_000);
+  });
+});
+
+describe("describeResources", () => {
+  it("groups and sorts, so the same leak reads the same on every exit", () => {
+    expect(describeResources(["Timeout", "TCPSocketWrap", "PipeWrap", "TCPSocketWrap"])).toBe(
+      "PipeWrap×1, TCPSocketWrap×2, Timeout×1",
+    );
+  });
+
+  it("says so when Node reports nothing", () => {
+    expect(describeResources([])).toBe("none reported");
+  });
+});

package/src/__tests__/golden-e2e.test.ts

@@ -7,14 +7,21 @@
  * - Expression evaluation via local activities (jq-wasm)
  * - Timer handling (sleep/wait)
  *
- * Prerequisites:
- * - @temporalio/testing ephemeral server binary (installed via npm)
- * - Temporal CLI (`temporal`) on PATH
+ * Prerequisites: none beyond `npm install`. `TestWorkflowEnvironment.createTimeSkipping()`
+ * downloads and runs Temporal's own test server, which skips a timer as soon as
+ * the workflow waits on it, so the goldens that wait minutes (#16 wait-delay,
+ * #21 retry-backoff) finish inside the per-test budget.
  *
  * The workflow-engine uses `deepClone` from `clone.ts` which falls
  * back to JSON round-trip when `structuredClone` is unavailable in
- * the Temporal deterministic V8 sandbox. Tests are skipped if the
- * environment can't start a Temporal test server.
+ * the Temporal deterministic V8 sandbox.
+ *
+ * Only one failure skips: the Temporal test server cannot boot (no network
+ * for the download, say). Each golden then skips by name with the boot
+ * error. Anything after the boot (the worker, the workflow bundle, a
+ * golden itself) fails. The suite once swallowed every error and returned
+ * early from each test, which vitest counts as a pass, so it reported
+ * sixteen passes without running a golden (stigmer#1300).
  *
  * Run with: npx vitest run src/__tests__/golden-e2e.test.ts
  */
@@ -24,8 +31,9 @@ import { readFileSync } from "node:fs";
 import { join, dirname } from "node:path";
 import { fileURLToPath } from "node:url";
 import { loadWorkflowFromYaml } from "../workflow-engine/loader.js";
+import { IN_TEST_GATE } from "../__test-utils__/test-gate.js";
 import { evaluateExpressionBatch } from "../workflow-engine/expression.js";
-import type { ExecuteServerlessWorkflowInput } from "../workflows/engine-core.js";
+import type { EngineActivities, ExecuteServerlessWorkflowInput } from "../workflows/engine-core.js";
 import type { WorkflowModel } from "../workflow-engine/types.js";
 import { INLINE_MODEL_WORKFLOW_TYPE } from "../__test-utils__/workflows/inline-model.js";
 
@@ -48,7 +56,8 @@ type Worker = import("@temporalio/worker").Worker;
 let env: TestWorkflowEnvironment | null = null;
 let worker: Worker | null = null;
 let workerRunPromise: Promise<void> | null = null;
-let envReady = false;
+/** Why the Temporal test server could not boot; `null` once it has. */
+let bootError: string | null = "not attempted";
 
 function createMockActivities() {
   return {
@@ -81,7 +90,12 @@ function createMockActivities() {
     ClearWorkflowApprovalStatus: async (): Promise<void> => {},
     UpdateWorkflowFileReviewStatus: async (): Promise<void> => {},
     GetAwaitingFileReviewChangeSetIds: async (): Promise<string[]> => [],
-  };
+    GetAgentExecutionProgress: async (): Promise<null> => null,
+    ResetEventSequence: async (): Promise<number> => 0,
+    EmitWorkflowEvents: async (): Promise<void> => {},
+    LoadRecoveryContext: async (): Promise<unknown[]> => [],
+    PromoteTaskOutput: async (): Promise<void> => {},
+  } satisfies Record<keyof EngineActivities, unknown>;
 }
 
 async function runGoldenWorkflow(model: WorkflowModel, workflowInput: unknown = null): Promise<unknown> {
@@ -96,34 +110,36 @@ async function runGoldenWorkflow(model: WorkflowModel, workflowInput: unknown =
     taskQueue: TASK_QUEUE,
     workflowId: `golden-e2e-${Date.now()}-${Math.random().toString(36).slice(2)}`,
     args: [input],
-    workflowExecutionTimeout: "30s",
+    // Workflow time, which the test server skips through: #16 alone waits 96s of
+    // timers. Real time stays bounded by vitest's per-test timeout.
+    workflowExecutionTimeout: "10m",
   });
 }
 
 describe("Golden E2E — Temporal TestWorkflowEnvironment", () => {
   beforeAll(async () => {
+    const { TestWorkflowEnvironment: TWE } = await import("@temporalio/testing");
+    const { Worker: W } = await import("@temporalio/worker");
+
     try {
-      const { TestWorkflowEnvironment: TWE } = await import("@temporalio/testing");
-      const { Worker: W } = await import("@temporalio/worker");
-
-      env = await TWE.createLocal();
-      worker = await W.create({
-        connection: env.nativeConnection,
-        taskQueue: TASK_QUEUE,
-        workflowsPath: WORKFLOWS_PATH,
-        activities: createMockActivities(),
-      });
-      workerRunPromise = worker.run();
-
-      // Smoke test: execute simplest workflow to verify sandbox compatibility
-      const smokeModel = loadWorkflowFromYaml(loadGolden("01-operation-basic.yaml"));
-      await runGoldenWorkflow(smokeModel);
-      envReady = true;
+      env = await TWE.createTimeSkipping();
     } catch (err: unknown) {
-      const msg = err instanceof Error ? err.message : String(err);
-      console.warn(`Temporal E2E smoke test failed (tests will be skipped): ${msg}`);
-      envReady = false;
+      // Inside a gate the test server is a provided dependency: not booting is a failure.
+      if (IN_TEST_GATE) throw err;
+      bootError = err instanceof Error ? err.message : String(err);
+      console.warn(`Temporal test server cannot boot; every golden skips: ${bootError}`);
+      return;
     }
+    bootError = null;
+
+    // Past the boot, a failure is the suite's to report, not to skip.
+    worker = await W.create({
+      connection: env.nativeConnection,
+      taskQueue: TASK_QUEUE,
+      workflowsPath: WORKFLOWS_PATH,
+      activities: createMockActivities(),
+    });
+    workerRunPromise = worker.run();
   }, 60_000);
 
   afterAll(async () => {
@@ -135,117 +151,119 @@ describe("Golden E2E — Temporal TestWorkflowEnvironment", () => {
   }, 30_000);
 
   // ─────────────────────────────────────────────────────────────────
-  // Each test skips gracefully if the Temporal test server
-  // cannot start or the smoke test fails.
+  // Each golden skips by name when the test server could not boot.
   // ─────────────────────────────────────────────────────────────────
 
-  it("#01 operation-basic — sequential set tasks", async () => {
-    if (!envReady) return;
+  it("#01 operation-basic — sequential set tasks", async (testCtx) => {
+    if (bootError !== null) return testCtx.skip(`Temporal test server cannot boot: ${bootError}`);
     const model = loadWorkflowFromYaml(loadGolden("01-operation-basic.yaml"));
     const result = await runGoldenWorkflow(model);
     expect(result).toEqual({ workflow_completed: true });
   });
 
-  it("#14 try-catch-raise — error handling pipeline", async () => {
-    if (!envReady) return;
+  it("#14 try-catch-raise — error handling pipeline", async (testCtx) => {
+    if (bootError !== null) return testCtx.skip(`Temporal test server cannot boot: ${bootError}`);
     const model = loadWorkflowFromYaml(loadGolden("14-try-catch-raise.yaml"));
     const result = await runGoldenWorkflow(model);
     expect(result).toEqual({ phase: "completed" });
   });
 
-  it("#15 fork-parallel — non-compete branches", async () => {
-    if (!envReady) return;
+  it("#15 fork-parallel — non-compete branches", async (testCtx) => {
+    if (bootError !== null) return testCtx.skip(`Temporal test server cannot boot: ${bootError}`);
     const model = loadWorkflowFromYaml(loadGolden("15-fork-parallel.yaml"));
     const result = await runGoldenWorkflow(model);
     expect(result).toBeDefined();
   });
 
-  it("#02 switch-conditional — HTTP + conditional branching", async () => {
-    if (!envReady) return;
+  it("#02 switch-conditional — HTTP + conditional branching", async (testCtx) => {
+    if (bootError !== null) return testCtx.skip(`Temporal test server cannot boot: ${bootError}`);
     const model = loadWorkflowFromYaml(loadGolden("02-switch-conditional.yaml"));
     const result = await runGoldenWorkflow(model);
     expect(result).toBeDefined();
   });
 
-  it("#03 foreach-loop — iteration with HTTP calls", async () => {
-    if (!envReady) return;
+  it("#03 foreach-loop — iteration with HTTP calls", async (testCtx) => {
+    if (bootError !== null) return testCtx.skip(`Temporal test server cannot boot: ${bootError}`);
     const model = loadWorkflowFromYaml(loadGolden("03-foreach-loop.yaml"));
     const result = await runGoldenWorkflow(model, { items: ["a", "b", "c"] });
     expect(result).toBeDefined();
   });
 
-  it("#04 parallel-concurrent — fork with HTTP branches", async () => {
-    if (!envReady) return;
+  it("#04 parallel-concurrent — fork with HTTP branches", async (testCtx) => {
+    if (bootError !== null) return testCtx.skip(`Temporal test server cannot boot: ${bootError}`);
     const model = loadWorkflowFromYaml(loadGolden("04-parallel-concurrent.yaml"));
     const result = await runGoldenWorkflow(model);
     expect(result).toBeDefined();
   });
 
-  it("#06 sleep-delay — wait + HTTP calls", async () => {
-    if (!envReady) return;
+  it("#06 sleep-delay — wait + HTTP calls", async (testCtx) => {
+    if (bootError !== null) return testCtx.skip(`Temporal test server cannot boot: ${bootError}`);
     const model = loadWorkflowFromYaml(loadGolden("06-sleep-delay.yaml"));
     const result = await runGoldenWorkflow(model);
     expect(result).toBeDefined();
   });
 
-  it("#07 inject-transform — expressions + HTTP", async () => {
-    if (!envReady) return;
+  it("#07 inject-transform — expressions + HTTP", async (testCtx) => {
+    if (bootError !== null) return testCtx.skip(`Temporal test server cannot boot: ${bootError}`);
     const model = loadWorkflowFromYaml(loadGolden("07-inject-transform.yaml"));
     const result = await runGoldenWorkflow(model, { a: 10, b: 20 });
     expect(result).toBeDefined();
   });
 
-  it("#08 error-retry — try/catch with HTTP", async () => {
-    if (!envReady) return;
+  it("#08 error-retry — try/catch with HTTP", async (testCtx) => {
+    if (bootError !== null) return testCtx.skip(`Temporal test server cannot boot: ${bootError}`);
     const model = loadWorkflowFromYaml(loadGolden("08-error-retry.yaml"));
     const result = await runGoldenWorkflow(model);
     expect(result).toBeDefined();
   });
 
-  it("#11 claimcheck-large-payload — sequential HTTP calls", async () => {
-    if (!envReady) return;
+  it("#11 claimcheck-large-payload — sequential HTTP calls", async (testCtx) => {
+    if (bootError !== null) return testCtx.skip(`Temporal test server cannot boot: ${bootError}`);
     const model = loadWorkflowFromYaml(loadGolden("11-claimcheck-large-payload.yaml"));
     const result = await runGoldenWorkflow(model);
     expect(result).toBeDefined();
   });
 
-  it("#12 claimcheck-between-steps — HTTP chain", async () => {
-    if (!envReady) return;
+  it("#12 claimcheck-between-steps — HTTP chain", async (testCtx) => {
+    if (bootError !== null) return testCtx.skip(`Temporal test server cannot boot: ${bootError}`);
     const model = loadWorkflowFromYaml(loadGolden("12-claimcheck-between-steps.yaml"));
     const result = await runGoldenWorkflow(model);
     expect(result).toBeDefined();
   });
 
-  it("#16 wait-delay — timer durations", async () => {
-    if (!envReady) return;
+  it("#16 wait-delay — timer durations", async (testCtx) => {
+    if (bootError !== null) return testCtx.skip(`Temporal test server cannot boot: ${bootError}`);
     const model = loadWorkflowFromYaml(loadGolden("16-wait-delay.yaml"));
     const result = await runGoldenWorkflow(model);
     expect(result).toEqual({ completed: true });
   });
 
-  it("#18 run-task — script + shell + workflow", async () => {
-    if (!envReady) return;
+  // quarantined: stigmer#1322 — `run.workflow` starts its child by the workflow's
+  // name, which no worker registers; the kind is refused at save until that issue
+  // lands, and this golden is its end-to-end reproduction.
+  it.skip("#18 run-task — script + shell + workflow", async (testCtx) => {
+    if (bootError !== null) return testCtx.skip(`Temporal test server cannot boot: ${bootError}`);
     const model = loadWorkflowFromYaml(loadGolden("18-run-task.yaml"));
     const result = await runGoldenWorkflow(model);
     expect(result).toEqual({ all_runs_done: true });
   });
 
-  it("#19 emit-event — CloudEvents envelope", async () => {
-    if (!envReady) return;
+  it("#19 emit-event — CloudEvents envelope", async (testCtx) => {
+    if (bootError !== null) return testCtx.skip(`Temporal test server cannot boot: ${bootError}`);
     const model = loadWorkflowFromYaml(loadGolden("19-emit-event.yaml"));
     const result = await runGoldenWorkflow(model);
     expect(result).toEqual({ events_emitted: true });
   });
 
-  it("#21 retry-backoff — catch-level retry", async () => {
-    if (!envReady) return;
+  it("#21 retry-backoff — catch-level retry", async (testCtx) => {
+    if (bootError !== null) return testCtx.skip(`Temporal test server cannot boot: ${bootError}`);
     const model = loadWorkflowFromYaml(loadGolden("21-retry-backoff.yaml"));
     const result = await runGoldenWorkflow(model);
     expect(result).toEqual({ phase: "completed" });
   });
 
-  it("#23 notification — webhook notification", async () => {
-    if (!envReady) return;
+  it("#23 notification — webhook notification", async (testCtx) => {
+    if (bootError !== null) return testCtx.skip(`Temporal test server cannot boot: ${bootError}`);
     const model = loadWorkflowFromYaml(loadGolden("23-notification.yaml"));
     const result = await runGoldenWorkflow(model);
     expect(result).toEqual({ notifications_sent: true });

package/src/__tests__/history-encryption-e2e.test.ts

@@ -15,8 +15,8 @@
  * converter has no Void special-case — a data-bearing encrypted result
  * would fail its converter lookup.
  *
- * Follows the golden-e2e pattern: tests skip gracefully when the
- * Temporal test server cannot start.
+ * Follows the golden-e2e pattern: the test skips by name only when the
+ * Temporal dev server cannot boot; any later failure fails it.
  */
 
 import { describe, it, expect, beforeAll, afterAll } from "vitest";
@@ -24,9 +24,11 @@ import { randomBytes } from "node:crypto";
 import { join, dirname } from "node:path";
 import { fileURLToPath } from "node:url";
 import { loadWorkflowFromYaml } from "../workflow-engine/loader.js";
+import { IN_TEST_GATE } from "../__test-utils__/test-gate.js";
 import { evaluateExpressionBatch } from "../workflow-engine/expression.js";
 import { EncryptionPayloadCodec } from "@stigmer/temporal-codecs";
-import type { ExecuteServerlessWorkflowInput } from "../workflows/engine-core.js";
+import type { EngineActivities, ExecuteServerlessWorkflowInput } from "../workflows/engine-core.js";
+import type { HydrateActivities } from "../workflows/execute-from-execution.js";
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const WORKFLOWS_PATH = join(__dirname, "../workflows/index.ts");
@@ -68,7 +70,8 @@ type Worker = import("@temporalio/worker").Worker;
 let env: TestWorkflowEnvironment | null = null;
 let worker: Worker | null = null;
 let workerRunPromise: Promise<void> | null = null;
-let envReady = false;
+/** Why the Temporal dev server could not boot; `null` once it has. */
+let bootError: string | null = "not attempted";
 
 function createMockActivities() {
   return {
@@ -90,6 +93,23 @@ function createMockActivities() {
     EmitWorkflowEvents: async (): Promise<void> => {},
     LoadRecoveryContext: async (): Promise<unknown[]> => [],
     PromoteTaskOutput: async (): Promise<void> => {},
+    CallGrpc: unscheduled("CallGrpc"),
+    CallFunction: unscheduled("CallFunction"),
+    RunScript: unscheduled("RunScript"),
+    RunShell: unscheduled("RunShell"),
+    CallAgent: unscheduled("CallAgent"),
+    UpdateWorkflowTaskApprovalStatus: unscheduled("UpdateWorkflowTaskApprovalStatus"),
+    ClearWorkflowApprovalStatus: unscheduled("ClearWorkflowApprovalStatus"),
+    UpdateWorkflowFileReviewStatus: unscheduled("UpdateWorkflowFileReviewStatus"),
+    GetAwaitingFileReviewChangeSetIds: unscheduled("GetAwaitingFileReviewChangeSetIds"),
+    GetAgentExecutionProgress: unscheduled("GetAgentExecutionProgress"),
+  } satisfies Record<keyof (EngineActivities & HydrateActivities), unknown>;
+}
+
+/** An activity the secret-bearing workflow never schedules; reaching it is a test bug. */
+function unscheduled(name: string): () => Promise<never> {
+  return async () => {
+    throw new Error(`${name} is not scheduled by the secret-bearing workflow`);
   };
 }
 
@@ -110,31 +130,35 @@ function collectByteFields(value: unknown, out: Uint8Array[]): void {
 
 describe("History encryption tripwire — Temporal TestWorkflowEnvironment", () => {
   beforeAll(async () => {
-    try {
-      const { TestWorkflowEnvironment: TWE } = await import("@temporalio/testing");
-      const { Worker: W } = await import("@temporalio/worker");
+    const { TestWorkflowEnvironment: TWE } = await import("@temporalio/testing");
+    const { Worker: W } = await import("@temporalio/worker");
 
+    try {
       env = await TWE.createLocal();
-      worker = await W.create({
-        connection: env.nativeConnection,
-        taskQueue: TASK_QUEUE,
-        workflowsPath: WORKFLOWS_PATH,
-        activities: createMockActivities(),
-        dataConverter: {
-          payloadCodecs: [
-            new EncryptionPayloadCodec({
-              primary: { keyId: "tripwire-key", key: randomBytes(32) },
-            }),
-          ],
-        },
-      });
-      workerRunPromise = worker.run();
-      envReady = true;
     } catch (err: unknown) {
-      const msg = err instanceof Error ? err.message : String(err);
-      console.warn(`Temporal test server unavailable (tests will be skipped): ${msg}`);
-      envReady = false;
+      // Inside a gate the test server is a provided dependency: not booting is a failure.
+      if (IN_TEST_GATE) throw err;
+      bootError = err instanceof Error ? err.message : String(err);
+      console.warn(`Temporal dev server cannot boot; the tripwire skips: ${bootError}`);
+      return;
     }
+    bootError = null;
+
+    // Past the boot, a failure is the suite's to report, not to skip.
+    worker = await W.create({
+      connection: env.nativeConnection,
+      taskQueue: TASK_QUEUE,
+      workflowsPath: WORKFLOWS_PATH,
+      activities: createMockActivities(),
+      dataConverter: {
+        payloadCodecs: [
+          new EncryptionPayloadCodec({
+            primary: { keyId: "tripwire-key", key: randomBytes(32) },
+          }),
+        ],
+      },
+    });
+    workerRunPromise = worker.run();
   }, 60_000);
 
   afterAll(async () => {
@@ -145,8 +169,8 @@ describe("History encryption tripwire — Temporal TestWorkflowEnvironment", ()
     if (env) await env.teardown();
   }, 30_000);
 
-  it("records no plaintext secret bytes anywhere in workflow history", async () => {
-    if (!envReady || !env) return;
+  it("records no plaintext secret bytes anywhere in workflow history", async (testCtx) => {
+    if (bootError !== null || !env) return testCtx.skip(`Temporal dev server cannot boot: ${bootError}`);
 
     const workflowId = `tripwire-${Date.now()}`;
     // The starting client has NO codec, mirroring the Java/Go

package/src/__tests__/runner.test.ts

@@ -1,5 +1,5 @@
-import { describe, it, expect } from "vitest";
-import { mapOptionsToConfig } from "../runner.js";
+import { describe, it, expect, vi } from "vitest";
+import { mapOptionsToConfig, releaseAfterDrain } from "../runner.js";
 import type { StigmerRunnerOptions, StigmerRunner } from "../runner.js";
 import type { TokenRef } from "../config.js";
 
@@ -224,3 +224,61 @@ describe("public API exports", () => {
     expect(typeof mod.createStigmerRunner).toBe("function");
   });
 });
+
+describe("releaseAfterDrain", () => {
+  function resources(opts: { harnessFails?: boolean; closeFails?: boolean } = {}) {
+    const order: string[] = [];
+    return {
+      order,
+      value: {
+        shutdownHarnesses: vi.fn(async () => {
+          order.push("harnesses");
+          if (opts.harnessFails) {
+            throw new Error("harness boom");
+          }
+        }),
+        connection: {
+          close: vi.fn(async () => {
+            order.push("connection");
+            if (opts.closeFails) {
+              throw new Error("close boom");
+            }
+          }),
+        },
+      },
+    };
+  }
+
+  it("releases the harnesses, then closes the Temporal connection", async () => {
+    const r = resources();
+    const logError = vi.fn<(line: string) => void>();
+
+    await releaseAfterDrain(r.value, logError);
+
+    expect(r.order).toEqual(["harnesses", "connection"]);
+    expect(logError).not.toHaveBeenCalled();
+  });
+
+  it("still closes the connection when a harness teardown fails, and logs it", async () => {
+    const r = resources({ harnessFails: true });
+    const logError = vi.fn<(line: string) => void>();
+
+    await releaseAfterDrain(r.value, logError);
+
+    expect(r.order).toEqual(["harnesses", "connection"]);
+    expect(logError).toHaveBeenCalledTimes(1);
+    expect(logError.mock.calls[0]?.[0]).toContain("Harness shutdown failed after the worker drained");
+    expect(logError.mock.calls[0]?.[0]).toContain("harness boom");
+  });
+
+  it("logs a failed close instead of throwing, so a clean stop stays clean", async () => {
+    const r = resources({ closeFails: true });
+    const logError = vi.fn<(line: string) => void>();
+
+    await expect(releaseAfterDrain(r.value, logError)).resolves.toBeUndefined();
+
+    expect(logError).toHaveBeenCalledTimes(1);
+    expect(logError.mock.calls[0]?.[0]).toContain("Temporal connection close failed after the worker drained");
+    expect(logError.mock.calls[0]?.[0]).toContain("close boom");
+  });
+});

package/src/activities/__tests__/classify-tool-approvals.test.ts

@@ -727,6 +727,7 @@ function makeConfig() {
     temporalConnection: {},
     stigmerBackendEndpoint: "http://localhost:7234",
   mcpBridgeEndpoint: null,
+  mcpPublicEndpoint: null,
     stigmerTokenRef: { current: "test-token" },
     cursorApiKey: "",
     workspaceRootDir: "/tmp/test",

package/src/activities/__tests__/discover-mcp-server.hang.test.ts

@@ -14,6 +14,10 @@
  */
 import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
 import { createServer, type Server } from "node:http";
+import { testConfig } from "../../__test-utils__/config-fixture.js";
+
+/** The runner endpoints discovery fills STIGMER_SERVER_ADDRESS from. */
+const PLATFORM_ENDPOINTS = testConfig();
 
 vi.mock("../../idle-watchdog.js", () => ({
   activityStarted: vi.fn(),
@@ -85,7 +89,7 @@ describe("discovery against a 4xx-then-silent-SSE endpoint (issue #239)", () =>
 
     const promise = discoverMcpServer(
       { mcpServerId: "mcp-monday" },
-      { stigmerClient: stigmerClient as never, transportPosture: "stdio-forbidden" },
+      { stigmerClient: stigmerClient as never, transportPosture: "stdio-forbidden", platformEndpoints: PLATFORM_ENDPOINTS },
     );
     // Attach the rejection expectation BEFORE advancing so the rejection is
     // never momentarily unhandled.